Image Watermarking

1. A computer implemented method, comprising: obtaining a first image and a first data item that is to be embedded into the first image; inputting the first data item into a channel encoder, wherein the channel encoder encodes an input data item of a first length into redundant data that (1) includes the input data item and (2) new data this is redundant of the input data item, and is of second length greater than the first length, wherein the new data enables recovery of the input data in the presence of channel distortion; obtaining, from the channel encoder and in response to inputting the first data item into the channel encoder, a first encoded data item; inputting the first encoded data item and the first image into an encoder model, wherein the encoder model encodes an input image and an input data item to obtain an encoded image into which the input data item has been embedded as a digital watermark; and obtaining, from the encoder model and in response to inputting the first encoded data item and the first image into the encoder model, a first encoded image into which the first encoded data has been embedded as a digital watermark.

2. The computer implemented method of claim 1, further comprising: inputting the first encoded image into a decoder model, wherein the decoder model decodes an input encoded image to obtain data that is predicted to be embedded as a digital watermark within the input encoded image; obtaining, from the decoder model and in response to inputting the first encoded image into the decoder model, a second data that is predicted to be the first encoded data; inputting the second data into a channel decoder, wherein the channel decoder decodes input data to recover original data that was previously encoded by the channel encoder to generate the input data; and obtaining, from the channel decoder and in response to inputting the second data into the channel decoder, third data that is predicted to be the first data.

3. The computer implemented method of claim 1, further comprising: obtaining a set of input training images; obtaining a first set of training images, wherein each image in the first set of training images is generated by encoding an input training image and an encoded data item using the encoder model, wherein the encoded data item is generated by encoding an original data item using the channel encoder; inputting the first set of training images into an attack network, wherein the attack network uses a set of input images to generate a corresponding set of images that includes different types of image distortions; and generating, using the attack network and in response to inputting the first set of input training images into the attack network, a second set of training images, wherein images in the second set of training images corresponds to images in the first set of training images.

4. The computer implemented method of claim 1, further comprising training the attack network using the first set of training images and the second set of training images, wherein the training comprises: for each training image in the first set of training images and a corresponding training image in the second set of training images: inputting the training image from the second set of training images into the decoder model; obtaining, from the decoder model and in response to inputting the the training image from the second set of training images into the decoder model, a first predicted data item that is predicted to be embedded as a digital watermark within the training image; determining a first image loss representing a difference in image pixel valus between the training image in the first set of training images and the corresponding training image in the second set of training images; determining a first message loss representing a difference between the first predicted data item and the encoded data item embedded into the training image in the first set of training images; and training the attack network using the first image loss and the first message loss.

5. The computer implemented method of claim 4, further comprising training the encoder model and the decoder model, wherein the training comprises: for each training image in the first set of training images: inputting the training image into the decoder model; obtaining, from the decoder model and in response to inputting the training image into the decoder model, a second predicted data item that is predicted to be embedded within the training image; determining a second image loss representing a difference in image pixel values between the training image and the corresponding input training image; determining a second message loss representing a difference between the second predicted data item and the encoded data embedded into the training image; and training each of the encoder model and decoder model using the second image loss, the second message loss, and the first message loss.

6. The method of claim 4, wherein each of the attack model, the encoder model, and the decoder model is a convolutional neural network.

7. The method of claim 5, wherein: the second image loss comprises an L2 loss and a GAN loss; and the second message loss comprises an L2 loss.

8. The method of claim 5, wherein each of the first message loss and the first image loss comprises an L2 loss.

9. The method of claim 2, further comprising training the channel encoder and the channel decoder, wherein the training comprises: obtaining a set of training data items; for each training data item in the set of training data items: generating, using the channel encoder, an encoded training data item; generating, for the encoded training data item and using a channel distortion approximation model, a modified training data item, wherein the encoded training data item is distorted using the channel distortion approximation model to generate the modified training data item; determining a channel loss representing a difference between the encoded training data item and the corresponding modified training data item; and training each of the channel encoder and the channel decoder using the channel loss.

10. A system, comprising: one or more memory devices storing instructions; and one or more data processing apparatus that are configured to interact with the one or more memory devices, and upon execution of the instructions, perform operations including: obtaining a first image and a first data item that is to be embedded into the first image; inputting the first data item into a channel encoder, wherein the channel encoder encodes an input data item of a first length into redundant data that (1) includes the input data item and (2) new data this is redundant of the input data item, and is of second length greater than the first length, wherein the new data enables recovery of the input data in the presence of channel distortion; obtaining, from the channel encoder and in response to inputting the first data item into the channel encoder, a first encoded data item; inputting the first encoded data item and the first image into an encoder model, wherein the encoder model encodes an input image and an input data item to obtain an encoded image into which the input data item has been embedded as a digital watermark; and obtaining, from the encoder model and in response to inputting the first encoded data item and the first image into the encoder model, a first encoded image into which the first encoded data has been embedded as a digital watermark.

11. The system of claim 10, wherein the one or more data processing apparatus are configured to perform operations further comprising: inputting the first encoded image into a decoder model, wherein the decoder model decodes an input encoded image to obtain data that is predicted to be embedded as a digital watermark within the input encoded image; obtaining, from the decoder model and in response to inputting the first encoded image into the decoder model, a second data that is predicted to be the first encoded data; inputting the second data into a channel decoder, wherein the channel decoder decodes input data to recover original data that was previously encoded by the channel encoder to generate the input data; and obtaining, from the channel decoder and in response to inputting the second data into the channel decoder, third data that is predicted to be the first data.

12. The system of claim 10, wherein the one or more data processing apparatus are configured to perform operations further comprising: obtaining a set of input training images; obtaining a first set of training images, wherein each image in the first set of training images is generated by encoding an input training image and an encoded data item using the encoder model, wherein the encoded data item is generated by encoding an original data item using the channel encoder; inputting the first set of training images into an attack network, wherein the attack network uses a set of input images to generate a corresponding set of images that includes different types of image distortions; and generating, using the attack network and in response to inputting the first set of input training images into the attack network, a second set of training images, wherein images in the second set of training images corresponds to images in the first set of training images.

13. The system of claim 10, wherein the one or more data processing apparatus are configured to perform operations further comprising training the attack network using the first set of training images and the second set of training images, wherein the training comprises: for each training image in the first set of training images and a corresponding training image in the second set of training images: inputting the training image from the second set of training images into the decoder model; obtaining, from the decoder model and in response to inputting the the training image from the second set of training images into the decoder model, a first predicted data item that is predicted to be embedded as a digital watermark within the training image; determining a first image loss representing a difference in image pixel values between the training image in the first set of training images and the corresponding training image in the second set of training images; determining a first message loss representing a difference between the first predicted data item and the encoded data item embedded into the training image in the first set of training images; and training the attack network using the first image loss and the first message loss.

14. The system of claim 13, wherein the one or more data processing apparatus are configured to perform operations further comprising training the encoder model and the decoder model, wherein the training comprises: for each training image in the first set of training images: inputting the training image into the decoder model; obtaining, from the decoder model and in response to inputting the training image into the decoder model, a second predicted data item that is predicted to be embedded within the training image; determining a second image loss representing a difference in image pixel values between the training image and the corresponding input training image; determining a second message loss representing a difference between the second predicted data item and the encoded data embedded into the training image; and training each of the encoder model and decoder model using the second image loss, the second message loss, and the first message loss.

15. The system of claim 13, wherein each of the attack model, the encoder model, and the decoder model is a convolutional neural network.

16. The system of claim 14, wherein: the second image loss comprises an L2 loss and a GAN loss; and the second message loss comprises an L2 loss.

17. The system of claim 14, wherein each of the first message loss and the first image loss comprises an L2 loss.

18. The system of claim 11, wherein the one or more data processing apparatus are configured to perform operations further comprising training the channel encoder and the channel decoder, wherein the training comprises: obtaining a set of training data items; for each training data item in the set of training data items: generating, using the channel encoder, an encoded training data item; generating, for the encoded training data item and using a channel distortion approximation model, a modified training data item, wherein the encoded training data item is distorted using the channel distortion approximation model to generate the modified training data item; determining a channel loss representing a difference between the encoded training data item and the corresponding modified training data item; and training each of the channel encoder and the channel decoder using the channel loss.

19. A non-transitory computer readable medium storing instructions that, when executed by one or more data processing apparatus, cause the one or more data processing apparatus to perform operations comprising: obtaining a first image and a first data item that is to be embedded into the first image; inputting the first data item into a channel encoder, wherein the channel encoder encodes an input data item of a first length into redundant data that (1) includes the input data item and (2) new data this is redundant of of the input data item, and is of second length greater than the first length, wherein the new data enables recovery of the input data in the presence of channel distortion; obtaining, from the channel encoder and in response to inputting the first data item into the channel encoder, a first encoded data item; inputting the first encoded data item and the first image into an encoder model, wherein the encoder model encodes an input image and an input data item to obtain an encoded image into which the input data item has been embedded as a digital watermark; and obtaining, from the encoder model and in response to inputting the first encoded data item and the first image into the encoder model, a first encoded image into which the first encoded data has been embedded as a digital watermark.

20. The non-transitory computer readable medium of claim 19, wherein the instructions cause the one or more data processing apparatus to perform operations comprising: inputting the first encoded image into a decoder model, wherein the decoder model decodes an input encoded image to obtain data that is predicted to be embedded as a digital watermark within the input encoded image; obtaining, from the decoder model and in response to inputting the first encoded image into the decoder model, a second data that is predicted to be the first encoded data; inputting the second data into a channel decoder, wherein the channel decoder decodes input data to recover original data that was previously encoded by the channel encoder to generate the input data; and obtaining, from the channel decoder and in response to inputting the second data into the channel decoder, third data that is predicted to be the first data.